Executive brief
Rejetto HFS, a popular lightweight file-sharing server, contains a security flaw in how it displays file names to users. An attacker can upload a file with a malicious name that, when viewed by others, executes unauthorized code in their web browser. This could lead to the theft of login sessions or unauthorized actions being performed on behalf of legitimate users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0 due to improper neutralization of input in the 'basic' web listing fallback. An attacker with file upload permissions—or an anonymous user if the server allows public uploads—can upload a file with a name containing a malicious JavaScript payload. While the default view might be secure, the vulnerable 'basic' listing can be forced by appending the '?get=basic' parameter to the URL. When a victim views this listing, the script executes in their browser context. The issue is addressed in version 3.2.1.
Affected products
- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0
Timeline
- 2026-07-13: disclosed
- 2026-07-13: patched: Fixed in version 3.2.1
- 2026-07-13: advisory